Re: [RFC PATCH 07/56] x86/bugs: Reset spectre_v2_user mitigations

Borislav Petkov
2025-11-26T11:23:50Z

On Thu, Oct 16, 2025 at 04:13:25PM +0000, Brendan Jackman wrote:
> This seems a bit over-complicated though, in practice it seems pretty
> likely that just hitting people with the unexpected errors is sort of
> OK? At least for the usecase I'm seeing everything through the lens of,
> I think it would be.

Yah, this topic does get my brain in a twist...

But I think I know what the right thing to do here should be:

If the admin goes and dynamically changes mitigation settings, no matter what
processes have selected previously, their settings will be changed once they
go through cond_mitigation().

If what userspace has selected previously and if that selection is not
compatible with what the dynamic, system-wide mitigation setting got changed
to, then the per-process setting will get changed.

Because the admin wanted it so and the admin can do anything. It is basically
the same as any other OS resource change - userspace needs to handle it and
adjust to it.

If the admin decides that the system wants to force mitigations on, then all
processes will have to comply. It is what it is.

It'll need a proper audit of all the TIF_SPEC_ and other flags and we would
have to even override them and issue warnings why we do so.

But I'm thinking: if the admin changes system-wide settings, the only right
thing for tasks is to comply.

I'd say.

--
Regards/Gruss,
Boris.